[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N provide? (Part 5)

[Assistant]
ocument, David Ferraiolo, is a member of the American National Standards Institute/International Committee for Information Technology (ANSI/INCITS) Next Generation Access Control (NGAC) working group.
To mitigate the injection of bias, prior drafts have been circulated for review to multiple subject matter experts, as well as formally to the public at large. In addition, prior to publication, the final draft of this document was reviewed by multiple independent entities in compliance with the requirements of the NIST Editorial Review Board (ERB). Disposition and resolution of comments were considered by the authors at large. ## Trademark Information

All registered trademarks or trademarks belong to their respective organizations. ## Executive Summary

Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC) are very different attribute based access control (ABAC) standards with similar goals and objectives. XACML, available since 2003, is an Extensible Markup Language (XML) based language standard designed to express security policies, as well as the access requests and responses needed for querying the policy system and reaching an authorization decision [1]. NGAC is a relations and architecture-based standard designed to express, manage, and enforce access control policies through configuration of its relations. What are the similarities and differences between these two standards? What are their comparative advantages and disadvantages? These questions are particularly relevant because XACML and NGAC are different approaches to achieving a common access control goal-to allow applications with vastly different access policies to be expressed and enforced using the features of the same underlying mechanism in diverse ways. These are also important questions, given the prevalence of data services in computing.

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators:

|                               | intended cryptographic strength.'                                                                                |
|-------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Pseudorandom Number Generator | See Deterministic Random Bit Generator . |
| Random Number                 | For the purposes of this Recommendation, a value in a set that has an equal probability of being selected from the total population of possibilities and, hence, is unpredictable. A random number is an instance of an unbiased random variable, that is, the output produced by a uniformly distributed random process. |
| Random Bit Generator (RBG)    | A device or algorithm that outputs a sequence of binary bits that appears to be statistically independent and unbiased. An RBG is either a DRBG or an NRBG. |
| Randomness Source             | A component of a DRBG (which consists of a DRBG mechanism and a randomness source) that outputs bitstrings that are used as entropy input by the DRBG mechanism. The randomness source can be an entropy source or an RBG. |
| Reseed                        | To acquire additional bits that will affect the internal state of the DRBG mechanism.

Recommendation for Random Number Generation Using Deterministic Random Bit Generators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

access control; confidentiality; cryptographic key management system; disaster recovery; federal cryptographic key management system; integrity; metadata; security assessment; security functions; security policies; source authentication. | 9.8                                                                                | Ease-of-Use Testing .....................................................................................

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Computer Model to Determine Low Cost Techniques to Comply with the Privacy Act of 1974:

1. Data supply obligation notification
2. Consent for additional use
3. Check usage authorization
- A. Usage log maintenance
5. Record existence notification
6. Record existence inquiry
7. Record uses inquiry
8. Data accuracy
9. Additional data
10. Data accuracy inquiry
11. Subject claim storage
12. Subject claim dissemination
13. Retroactive claim dissemination
14. Record transmission
15. Consent to transfer data
16. Legal process notification
17. Physical security
18. User training
19. System assurance
20. Public notice

```
U ^' M P A H A ^K'li:? A SS 1 GfJ MFM5 .^'POT NO, OF PFO'TS IN THF MUOhL NKF NO, OF FE'S IN THE MODFL f«iPLC AVG, riO, OF ACCFSS Ct)NTRGL e:NTRlFwS PFP RtCORD t-i{.GS fJO, OF TIMKS PEP YEAR IJSAGP LOG IS SPIAPCHFD FAOY FF-ACTION OF kECOPDS 10 //HJCH "ADDITIONAL DATA" tS ADD^n (PFP YEAR) »SCrC vSIZP (^F ilSFP/OPFKATnp TRAJMlKG CLASSPJS FTR A^'^'llA^ THAlN'l'^G VOLUME ^S FRACTION OF INITIAL tPG'-JT ANNUAL PROGRAM r A T N TE N A viC P! FFFUPT AS FRACTION OF I'^'ITIAL DFVt LOpMENT EFFUR r IPIlM PUN COUNTER THE NUMBER OF CPU I ST [JilC T 1 0 G EXECUTED T0-ISC>J SCAN A Flf.E (PER PECOpO) lEpM POPNAT A SI^^PLE REQUEST TO A DATA SUBJECT rCACL CHECK AN ACCESS CONTROL LIST f/.AC WFllE AN ACCtSS CONTPOb Ef'll-Y DATA OT, NF E, lipLC, NLGS/FALY , SCLS,FTR, P^G^nJ^ , I RUN 1 / ? f . , 1 6 , 0 . 5 f 5 2 . U , 0 . 0 0 0 1 , 1 0 , 0 , f ) . 2 , 0 , 2 , U / DATA I sr r.' , T F p H , 7 C AC L , T W AC 1 /2o'jO,, 100(», ,1 000. #500,/ SfATEMEI'l pUNCiroM r)hFlf'lTXON TIMP. TO SORT P RECORDS OF hEUGT'.] r, Si»H(l ,f,) s R « L * O.0OUO21H i 1 r r T fipll T EUPMATS , , 8 00 1 FORMAT ( PGl n ,0) eu0 2 FORI AT f 2G 1 0 ,11, I 1 O, Gl u .0, 2L1 n,G10,0, Ll 0) POOi FnHMAT(4Gl 0,n,LlO|GlO,0,2Ll 0) 8004 EOR-^Ai ( 25' 1 ) 8 0'>S FDPf P r( HfiAl )
```

- NRLC -The number of record level access control fields per record. - NRPR -The number of record retrieval programs utilizing the data base. - NRUI -Number of record usage inquiries per year.

A Computer Model to Determine Low Cost Techniques to Comply with the Privacy Act of 1974


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters provide?

[Assistant]
## NISTIR 7711

## Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters

<!-- image -->

[This page intentionally left blank. ]

## NISTIR 7711

## Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters

Andrew Regenscheid Geoff Beier

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

DRAFT

September 2011

<!-- image -->

U.S. Department of Commerce Rebecca M. Blank, Acting Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary for Standards and Technology and Director

[This page intentionally left blank. ]

## Abstract

This document outlines the basic process for the distribution of election material including registration material and blank ballots to Uniformed and Overseas Citizen Absentee Voting Act (UOCAVA) voters. It describes the technologies that can be used to support the electronic dissemination of election material along with security techniques - both technical and procedural - that can protect this transfer. The purpose of the document is to inform Election Officials about the current technologies and techniques that can be used to improve the delivery of election material for UOCAVA voters. This document is part of a series of documents that address the UOCAVA voting. The first National Institute of Standards and Technology (NIST) publication on UOCAVA voting, entitled NISTIR 7551 A Threat Analysis on UOCAVA Voting Systems , was released in December 2008. In addition to NISTIR 7551, NIST has released NISTIR 7770 Security Considerations for Remote Electronic UOCAVA Voting , Accessibility and Usability Considerations for Remote Electronic UOCAVA Voting, and NISTIR 7682 Information Systems Security Best Practices for UOCAVA-Supporting Systems.

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

3.1.6   Architectural Locations ... 3.1.6   Architectural Locations

The selection of cyber resiliency techniques or approaches depends, in part, on where (i. 3.1.6.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Computer Security Division 2015 Annual Report:

| VALIDATION PROGRAMS.............................................................................................................................................................46 | | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------| | Cryptographic System Validation.....................................................................................................................................................46 | | | Cryptographic Programs and Laboratory Accreditation...............................................................................................................46 | | | Automated Security Testing and Test Suite Development.............................................................................................................51 | | | Security Content Automation Protocol (SCAP) Validation Program...........................................................................................54 | | | IDENTITY MANAGEMENT | | | ............................................................................................................................................................55 NIST Personal Identity Verification Program (NPIVP)...................................................................................................................

Computer Security Division 2015 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

This Handbook is intended primarily for use by Program Office Computer Security Managers (PO-CSM's) at Headquarters and Center Computer Security Managers (CCSM's) at field centers; however, it has been structured to allow anyone from senior management to technical support personnel to quickly understand the overall concepts and their personal relationship to the program. The intention of providing implementation flexibility in the guidance portions is to encourage the exercise of sound judgement by those closest to a problem. PO-CSM's and CCSM's are expected to apply common sense in determining appropriate variations and exceptions that may become necessary in specific computing environments. | Paraaraoh   |                                                       |                                                       | Pace   |
|-------------|-------------------------------------------------------|-------------------------------------------------------|--------|
|             | c. | Personnel Screening                                   | 3-6    |
|             | d. | Access Protection and Accountability                  | 3-6    |
|             | e. | Compliance Assurance                                  | 3-6    |
|             | f                                                     | Contingency and Disaster Recovery Plans               | 3-7    |
|             | g-                                                    | Approval of Methodologies                             | 3-7    |
| 303         | Risk                                                  | Assessment Process                                    | 3-7    |
| 304         | Protective Measures to Prevent Misuse and Abuse       | Protective Measures to Prevent Misuse and Abuse       | 3-10   |
| 305         | Certification                                         | Process                                               | 3-10   |
|             | a.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

Configuration Management (CM) comprises a collection of activities focused on establishing and maintaining the integrity of products and systems, through control of the processes for initializing, changing, and monitoring the configurations of those products and systems.

5 Information security is the protection of information and systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. For the purposes of this publication, 'security' is used synonymously with 'information security,' and 'system' is used synonymously with 'information system.'

The management of configurations has traditionally been viewed as an IT management best practice. 7 Using SecCM to gain greater control over and ensure the integrity of IT resources facilitates asset management, improves incident response, help desk, disaster recovery and problem solving, aids in software development and release management, enables greater automation of processes, and supports compliance with policies and preparation for audits.

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations:

As the risk to an information system's confidentiality, integrity and/or availability increases, the need for additional controls to protect the system may also increase accordingly.  SP 800-53 Revision 4 provides the security control baselines as the starting point for the security control selection process. The baselines are chosen based on the security category and associated impact level of information systems as described in Federal Information Processing Standard Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems .

- Authority and Purpose (AP);
- Accountability, Audit, and Risk Management (AR);
- Data Quality and Integrity (DI);
- Data Minimization and Retention (DM);
- Individual Participation and Redress (IP);
- Security (SE);
- Transparency (TR); and,
- Use Limitation (UL).

Summary of NIST SP 800-53, Revision 4_ Security and Privacy Controls for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cell Phone Forensic Tools_ an Overview and Analysis provide? (Part 5)

[Assistant]
document is law enforcement, incident response team members, and forensic examiners who are responsible for conducting forensic procedures related to cell phone devices and associated removable media.
## Table of Contents

| INTRODUCTION......................................................................................................................... | 1                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| BACKGROUND........................................................................................................................... | 3                                                                                |
| SUBSCRIBER IDENTITY MODULE.................................................................................................. | 5                                                                                |
| REMOVABLE MEDIA .................................................................................................................... | 6                                                                                |
| FORENSIC TOOLKITS..............................................................................................................

Cell Phone Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Federal S_MIME V3 Client Profile provide? (Part 5)

[Assistant]
ipts and vendor B chooses not to, then the signed receipts requested by the user of vendor A's products will never be sent by vendor B's product although neither implementation violates the standards.
To help assure that S/MIME products can interoperate and meet the e-mail security needs of federal agencies both with respect to security features, and adequate cryptographic algorithms, NIST has developed this Federal S/MIME V3 Client Profile. This profile states requirements for implementing sets of cryptographic algorithm suites specified elsewhere by the standards development organizations. The profile specifies a set of e-mail security features (e.g., encrypted e-mail, signed receipts) that are mandatory to be implemented. In the definition of this Profile, NIST's intention is never to violate underlying S/MIME standards, but rather to provide additional specificity within the standards. While NIST believes that use of this profile will help assure interoperability of the near term secure e-mail products, NIST anticipates that future revisions of the profile will be required to reflect new cryptographic algorithms and related attacks, new underlying S/MIME standards, and new e-mail security features required by federal agencies. The use of S/MIME requires the establishment of a Public Key Infrastructure (PKI) to support each sender and recipient of S/MIME messages. While the details of PKI are out of scope for this document, it is important to note that PKI is used to provide mechanisms to establish the identity of S/MIME users (known as authentication) and to provide for digital signatures, confidentiality, non-repudiation of sender, etc. X.509 Certificates are used to bind an entity's identity and public key for secure operations for S/MIME and other PKI-enabled secure applications. For a further understanding of PKI, see [Kuhn01], [Housley01], or [Adams00] in the References clause.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity of Genomic Data:

Fig. 1 summarizes the genomic lifecycle and contrasts those areas that are out of scope for this report-Sample Collection and Sample Preparation-with what is considered in scope-Data Generation and Data Analysis. Additionally, organizations processing genomic data should also consider proper data retention and disposal.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

The cryptographic algorithms, key sizes, and parameters that may be used for these keys are specified in Sec. 3.1. PIV Cards must implement private key computations for one or more of the algorithms identified in this section.

FIPS 201-3 identifies a suite of objects that are stored on the PIV Card for use in authentication mechanisms or other security protocols. These objects may be divided into three classes: cryptographic keys, signed authentication information stored on the PIV Card, and message digests of information stored on the PIV Card. Cryptographic requirements for PIV keys are detailed in Sec. 3.1. Cryptographic requirements for other stored objects are detailed in Sec. 3.2.

## 3.1. PIV Cryptographic Keys

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Guide to Bluetooth Security:

3.2.4 Low Energy Secure Connection Key Generation... 3.2.4 Low Energy Secure Connection Key Generation... 3.2.4 Low Energy Secure Connection Key Generation

Low energy Secure Connections security introduced in Bluetooth 4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Secure Domain Name System (DNS) Deployment Guide:

domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication.
Availability of DNS services and data is also very important; DNS components are often subjected to denial-of-service attacks intended to disrupt access to the resources whose domain names are handled by the attacked DNS components. This document presents guidelines for configuring DNS deployments to prevent many denial-of-service attacks that exploit vulnerabilities in various DNS components.

Secure Domain Name System (DNS) Deployment Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0 provide? (Part 3)

[Assistant]
ith the responsibility to develop or review Protection Profiles. ## Presentation

This document is presented as a protection profile, followed by a rationale that is structured as a separate document.
This format was selected to facilitate using this guidance as a template for the development of Protection Profiles. 1 The Computer Security Act defines the term 'sensitive information' as: any information, the loss, misuse, or unauthorized access to or modification of which could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under section 552a of title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense or foreign policy .

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Assessing Security Requirements for Controlled Unclassified Information support CMMC certification?

[Assistant]
According to Assessing Security Requirements for Controlled Unclassified Information:

other than the ones noted above, are available at

Organizations are encouraged to review all draft publications during public comment periods and provide feedback https://csrc.nist.gov/publications.
## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283 [1]. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130 [2]. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-04-23 Supersedes NIST Special Publication 800-171A (June 2018) https://doi.org/10.6028/NIST.SP.800-171A

## How to Cite this NIST Technical Series Publication:

Ross R, Pillitteri V (2024) Assessing Security Requirements for Controlled Unclassified Information and Organizations.

Assessing Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Random Number Generation Using Deterministic Random Bit Generators:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. There are two fundamentally different strategies for generating random bits. One strategy is to produce bits non-deterministically, where every bit of output is based on a physical process that is unpredictable; this class of random bit generators (RBGs) is commonly known as non-deterministic random bit generators (NRBGs) 1 . The other strategy is to compute bits deterministically using an algorithm; this class of RBGs is known as Deterministic Random Bit Generators (DRBGs) 2 . |                                       | source of ideal random bitstrings of the same length (see ideal random sequence ).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

Tim Grance and Murugiah Souppaya of NIST and Lucinda Gagliano, Thomas Goff, and Pius Uzamere of Booz Allen Hamilton for their keen and insightful assistance throughout the development of the document.
The authors would also like to express their thanks to security experts Mike Danseglio (Microsoft), Kurt Dillard (Microsoft), Michael Gerdes (Getronics RedSiren Security Solutions), Peter Szor (Symantec), Miles Tracy (U.S. Federal Reserve System), and Lenny Zeltser (Gemini Systems LLC), as well as representatives from the General Accounting Office, and for their particularly valuable comments and suggestions.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

3.1.3                                                                                | IPv6 Address Types... 3.1.3 IPv6 Address Types

IPv6 uses the notion of address types for different situations.

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

3.2.3 Non-Component Object CI Baselines
- 3.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Public Safety Mobile Application Security Requirements Workshop Summary:

To both prepare and adapt to the multitude of circumstances faced by first responders, public safety applications should allow for remote configuration of their power consumption. This configuration can come from two primary sources. The first comes in the form of a power management profile tailored for a first responder's specific needs. For example, a firefighter may have very different power needs from a police officer. Power management profiles for a first responder's specific needs can be applied to a device prior to it entering the field. Applications that expose themselves to this profile could adjust their behavior by changing their network interactions, processing requirements, or shutting themselves off completely.

It was the consensus of the workshop that app developers should be presented with a baseline set of data protection capabilities/functionality that represents the minimum need for public safety. A baseline set of data protection would need a public safety information classification system or framework. In order to protect data consistently, developers need to know what information can/should be shared, whom can the information be shared with, and how the sharing is controlled. Some information can be shared with anyone. However, protecting the integrity and availability of public information is important. Sensitive information may only be intended for authorized recipients making the confidentiality, integrity, and availability of this data critical. Developers may stand to benefit from unified data dictionaries describing first responder-specific information types and the data protection requirements for each.

Public Safety Mobile Application Security Requirements Workshop Summary


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

3.2.2                                                                                | Logging Capabilities ... 3.2.2 Logging Capabilities

IDPSs typically perform extensive logging of data related to detected events. 3.2.2 provides more information on ongoing maintenance of the technologies, with Section 3.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”:

Amit Elazari, Intel, described the concept of outcome-based (or performance-based) requirements as a fundamental principle that can be found as a common theme in security policies. She pointed out that the pace of technology innovation means that attack surfaces, the cyber threat landscape, and the overall complexity of the technology ecosystem are constantly evolving, so it is valuable to have requirements that provide flexibility for the future. An example here was that the NIST criteria focus on authentication, whereas other post-Mirai guidance often focused on prohibiting default passwords; the more prescriptive approach could preclude moving on to preferable security solutions. She also saw this approach as useful in building trust with consumers.

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Domain Name System (DNS) Deployment Guide provide? (Part 3)

[Assistant]
http://csrc.nist.gov/publications. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S.
economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. ## Abstract

The Domain Name System (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of computing and communication entities called Name Servers each of which contains information about a small portion of the domain name space. The domain name data provided by DNS is intended to be available to any computer located anywhere in the Internet.This document provides deployment guidelines for securing DNS within an enterprise. Because DNS data is meant to be public, preserving the confidentiality of DNS data. The primary security goals for DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is NIST SP 800-171 control 3.0.1?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

3.0.1.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Security Recommendations for Server-based Hypervisor Platforms:

- Providing selective connectivity or isolation between  groups of VMs belonging to different logical groupings (e.g., different tenants in the case of an Infrastructure as a Service (IaaS) cloud service; different application tiers such as Web Server or Database Server; or different Line of Business applications of an enterprise)
- Dedicating subnets for key functions such as (a) migration of VMs from one hypervisor host to another for security or performance reasons, (b) attaching network-based storage devices, and (c) fault Tolerant Logging
- Providing access to the management interface in the management VM (a node of the virtual network), which is used for performing key hypervisor baseline functions of VM lifecycle management (HY-BF4) and Management of hypervisor platform (HY-BF5)

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Computer Security Division 2013 Annual Report:

| Welcome Letter                                                                                | ..................................................................1   |
|----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
| Computer Security Division (CSD) Management Team.......2                                                                                |                                                                       |
| Computer Security Division Organization                                                                                | ..........................3                                           |
| The Computer Security Division Implements the Federal Information Security Management Act                                                          | .................7                                                    |
| Program & Project Achievements for Fiscal Year 2013                                                                                | .....9                                                                |
| NIST Responsibilities Under Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity'                                               | ....................10                                                |
| Contributions to National and International Standards Development...........................................................................11     |                                                                       |
| Identity Management Standards within INCITS B10 and ISO JTC1/SC 17 ................................................................

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Configuration Management?

[Assistant]
According to A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data:

The rest of the publication is organized as follows. Section 2 presents an overview of hypervisor taxonomy and briefly describes the architecture of Xen and KVM hypervisor products as well as related work in the area of vulnerability/forensic analysis. Section 3 discusses the gathering of recent vulnerabilities in the two hypervisor products and the classification of those vulnerabilities in terms of hypervisor functionality, attack types and attack sources. Section 4 describes the sample attacks, information gathered in the initial log configuration, and discusses the gaps in forensic evidence that is required for fully detecting and reconstructing those attacks. Identification and discussion  of  techniques  required  to  gather  the  needed  evidence  and  the  inclusion  of  those techniques in subsequent attack runs are also part of this section. Section 5 provides the summary and benefits. The NIST-NVD is the U.S. government repository of standards-based vulnerability management data  and  includes  databases  of  security  checklist  references,  security-related  software  flaws, misconfigurations, product names, and impact metrics [14]. The first task of the first step is to obtain all vulnerabilities (tagged with Common Vulnerabilities and Exposures (CVE) numbers)) in two open-source hypervisors (Xen and KVM) from the NIST-NVD for the years 2016 and 2017.

A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automation Support for Control Assessments_ Project Update and Vision provide? (Part 2)

[Assistant]
ter Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

All comments are subject to release under the Freedom of Information Act (FOIA).
## Abstract

In 2017, the National Institute of Standards and Technology (NIST) published a methodology for supporting the automation of Special Publication (SP) 800-53 control assessments in the form of Interagency Report (IR) 8011. IR 8011 is a multi-volume series that starts with an overview of the methodology (volume 1) and provides guidance and specifications for automating the assessment of controls that support specific information security continuous monitoring security capabilities, one volume per capability. Four volumes have been released so far, and more volumes are in development. In 2023, the NIST Risk Management Framework project responsible for the development and maintenance of Federal Information Security Modernization Act (FISMA)-supporting technical publications and the IR 8011 series performed an internal review of the IR 8011 project. This review yielded results that offered the IR 8011 Development Team opportunities to improve the current IR 8011 methodology, facilitate its adoption, and more. This cybersecurity white paper summarizes some of the findings from this internal review. ## Keywords

actual state; assessment; attack; automation; capability; community of interest; CoI; control; control assessment; control item; defect; defect check; defend; desired state specification; FISMA; information security continuous monitoring; ISCM; methodology; monitoring; ongoing assessment; privacy; risk; risk management; security; security automation. ## Table of Contents

| 1.

Automation Support for Control Assessments_ Project Update and Vision


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to A Formal Description of the SDNS Security Protocol at Layer 4 (SP4):

## 3.2.1 SP4E External to Transport

## 3.2.2 Connectionless Network Interface

## 3.2.4 Estelle Idiosyncrasies

A Formal Description of the SDNS Security Protocol at Layer 4 (SP4)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”:

fectively monitor and address IoT product security risks. Jasyn briefly summarized the threat landscape and some recent high-profile events as motivating factors for OEMs to consider product security.
He then described in detail Zebra's approach, based on three principles:

There were some discussions on distinctions between IT and IoT, and how some assumptions about how security is implemented in IT products do not hold for IoT products, particularly when addressing safety, privacy, different types of supply chains, and the often unique and highly-diverse and complex environments within which the IoT devices are used. Panelists generally agreed that consideration of complete IoT products, instead of the specific IoT devices, will require changes in the ways in which associated risk assessments are performed, necessarily widening the scope. It will also change the ongoing risk management activities, requiring more types of activities to address the full IoT product instead of just considering the IoT device. This, in turn, will require the ability to obtain more information from throughout the supply chain. For


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012 provide? (Part 2)

[Assistant]
ion systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems.
This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## National Institute of Standards and Technology Interagency Report 7916 276 pages (February 2013)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by Federal agencies even before the completion of such companion publications.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies:

1. Immersive Technology Ecosystem and Use Cases '[T]he ecosystem of entities that support immersive technologies. This ecosystem encompasses a range of entities and roles that may have complex, multi-directional relationships. Complexity can increase when entities are supported by a chain of sub-entities (e.g., manufacturers supported by multiple component suppliers).'
2. Immersive Technology Ecosystem and Use Cases '[C]urrent and potential future uses and misuses of immersive technologies across all applicable sectors and user bases, including any barriers to adoption.'
3. Privacy and Cybersecurity Risk Considerations 'Immersive technologies may generate cybersecurity and privacy risks, some of which can be novel or mix in complex ways.'
4. Immersive Technology Standards and Risk Management Resources 'Immersive technologies may break existing cybersecurity and privacy assumptions, requiring adaptation or update to tools and techniques documented in standards and guidelines. Additionally, immersive technologies may warrant new standards and guidelines efforts to complement existing resources.'

NIST seeks comment on the ecosystem of entities that support immersive technologies. This ecosystem encompasses a range of entities and roles that may have complex, multi-directional relationships. Complexity can increase when entities are supported by a chain of sub-entities (e.g., manufacturers supported by multiple component suppliers). In particular, NIST seeks stakeholder feedback on the following topics:

Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to PBX Administrator’s Security Standards:

l Operations                    | 2-3      |
| Call Diverter Schemes                   | 2-3      |
| Remote Access Fraud                     | 2-3      |
| Voice Mail Fraud                        | .
2-4    |
| Recent Telephone Industry Trends        | 2-5      |
| Section 3: PBX Administration           |          |
| Summary of Responsibilities             | 3-1      |
| Duties and Responsibilities             | 3-3      |
| Know Your PBX                           | 3-3      |
| Monitor PBX Options and Settings        | 3-3      |
| Set Passwords                           | 3-3      |
| Review Telephone Bills                  | 3-4      |
| Educate Fellow Employees                | 3-5      |
| Set Time and Day Restrictions           | 3-5      |
| Destroy Old PBX Manuals                 | 3-6      |
| Protect Corporate Telephone Books       | 3-6      |
| Know the Symptoms of PBX Fraud          | 3-6      |
| Know the Symptoms of Voice Mail Fraud   | 3-7      |
| Protect Your Voice Mail System          | 3-7      |
| Restrict DID and Outward Calling Access | 3-8      |
| Prohibit DISA Use                       |          |
| Restrict Call Transfer Capabilities     | 3-9 3-10 |
| Change System Administrator Passwords   | 3-11     |
| Limit Country Code Access               | 3-12     |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Security and Privacy Controls for Information Systems and Organizations provide?

[Assistant]
NIST Special Publication 800-53
Revision 5

Security and Privacy Controls for
Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r5

NIST Special Publication 800-53
Revision 5

 Security and Privacy Controls for

Information Systems and Organizations

JOINT TASK FORCE

This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-53r5

September 2020
INCLUDES UPDATES AS OF 12-10-2020; SEE PAGE XVII

National Institute of Standards and Technology
      Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

U.S. Department of Commerce
Wilbur L. Ross, Jr., Secretary

T
h
s

i

p
u
b

l
i

c
a

t
i

o
n

i

s

a
v
a

i
l

l

a
b
e
f
r
e
e
o
f

c
h
a
r
g
e
f
r
o
m

:

h
t
t
p
s
:
/
/
d
o
i
. o
r
g
/
1
0
. 6
0
2
8
/
N
S
T
S
P
. 8
0
0
-
5
3
r
5

. I

NIST SP 800-53, REV. 5                                                                                SECURITY AND PRIVACY CONTROLS FOR INFORMATION SYSTEMS AND ORGANIZATIONS
_________________________________________________________________________________________________

Authority

This publication has been developed by NIST to further its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA), 44 U.S.C. § 3551 et seq., Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines,
including minimum requirements for federal information systems. Such information security
standards and guidelines shall not apply to national security systems without the express
approval of the appropriate federal officials exercising policy authority over such systems. This
guideline is consistent with the requirements of the Office of Management and Budget (OMB)
Circular A-130.

Security and Privacy Controls for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

| CSF Element | CSF Element Description | Priority | Recommendations, Considerations, Notes assist with maintaining cross-references | |---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Medium | N1: See the notes for ID.RA.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

3.1.3 status = DRBG\_Reseed ( RBG3\_DRBG\_state\_handle, extra\_bits || additional\_input ) . 3.1.3,  the Get\_randomness\_source\_input call  in  the DRBG\_Reseed function is replaced by:

- o ( status , seed\_material ) = Get\_entropy\_bitstring ( s , Method\_1 ) .

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.8 (NIST 3.2.8)?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

3.2.8. 3.2.8 Tag Polling

Control: A reader periodically queries the tag to determine its continued presence and operating status. 3.2.8 Tag Polling                                | X                           |                             |                             |                                              |                                |
| 5.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

3.5.1 Privacy And Information Security Provisions

Section 5, 'Policy,' subparagraph f, 'Privacy and Information Security,' subparagraph 2), 'Information Security,' requires agencies to provide proper safeguards to:

- a) Ensure that the CIO designates a senior agency information security officer to develop and maintain an agency-wide information security program in accordance with the Federal Information Security Modernization Act of 2014;
- b) Protect information in a manner commensurate with the risk that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of such information; and
- c) Implement security policies issued by OMB, as well as requirements issued by the Department of Commerce, the Department of Homeland Security (DHS), the General Services Administration (GSA), and the Office of Personnel Management (OPM).

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to An Industrial Control System Cybersecurity Performance Testbed:

Receptacle for Machining Stations .....................................................................................12 | | 3.2.3.1 | Robot Assembly Table.....................................................................................................12 | Robot Assembly Table.....................................................................................................12 | | 3.2.4 | Emergency Stop Operation.................................................................................................13 | Emergency Stop Operation.................................................................................................13 | | 3.2.5 | Software Architecture.........................................................................................................14 | Software Architecture.........................................................................................................14 | | 3.2.5.1 | Control Layer...................................................................................................................14 | Control Layer...................................................................................................................14 | | 3.2.5.2 | PLC I/O Layer...................................................................................................................15 | PLC I/O Layer...................................................................................................................15 | | 3.2.5.3 | ROS Bags .........................................................................................................................15 | ROS Bags .........................................................................................................................15 | | 3.2.5.4 | ROS versus ROS Industrial...............................................................................................15 | ROS versus ROS Industrial...............................................................................................15 | | 3.2.5.5 | Theory of Operation........................................................................................................15 | Theory of Operation........................................................................................................15 | | 3.2.6 | Final Assembly.....................................................................................................................16 | Final Assembly.....................................................................................................................16 | | 3.3 | Third Enclave Concepts...............................................................................................................16 | Third Enclave Concepts...............................................................................................................16 | | 3.3.1 | Intelligent Transportation System ......................................................................................16 | Intelligent Transportation System ......................................................................................16 | | 3.3.2 | Wide-area Networks with SCADA.......................................................................................16 | Wide-area Networks with SCADA.......................................................................................16 |

An Industrial Control System Cybersecurity Performance Testbed


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.4 (NIST 3.2.4)?

[Assistant]
According to Guidelines on Securing Public Web Servers:

3.2.4                                                                                | Web Server and Network Administrators ... 3.2.4 Web Server and Network Administrators

Web server administrators are system architects responsible for the overall design, implementation, and maintenance of a Web server.

Guidelines on Securing Public Web Servers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

The growth of the stablecoin market and its associated identified risks have centered much research on stablecoins, usually with a focus on economic aspects. For example, the U.S. Treasury evaluates stablecoin risks in [5]. These risks include concerns about investor protection and market integrity, encompassing 'possible fraud and misconduct in digital asset trading, including market manipulation, insider trading, and front running, as well as a lack of trading or price transparency'. As stablecoins are increasingly used for complex financial arrangements and massive leveraging, the U.S. Treasury envisions possible risks to the broader financial system. In addition, it explores how stablecoin use could challenge efforts to govern 'anti-money laundering (AML), countering the financing of terrorism (CFT), and proliferation'. Lastly, it explores prudential risks for stablecoins, where stablecoin issuers may not maintain sufficient reserves or an effective method to support redemptions in times of stress. A complementary evaluation of the economic aspects of stablecoins is [1], which explores the possible impacts of stablecoins on the banking system and credit intermediation. IOSCO [4] presents another risk analysis (with a regulatory focus) and enumerates stablecoin risks related to 'consumer protection, market integrity, transparency, conflicts of interest, financial crime, systemic implications and economic impacts'. A deep analysis of how fiat-based stablecoins maintain their stability is found in [6], which evaluates how the price stabilization of stablecoins differs from national currencies pegged to one another. Finally, the specific risks of uncollateralized algorithmic stablecoins are highlighted in [2].

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

s://doi.org/10.6028/NIST.SP.800-160v1r1
- [17] Boyens JM, Smith AM, Bartol N, Winkler K, Holbrook A, Fallon M (2022) Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-161r1-upd1, Includes updates as of November 1, 2024. https://doi.org/10.6028/NIST.SP.800-161r1-upd1
- [18] Heckert N, Filliben J, Croarkin C, Hembree B, Guthrie W, Tobias P, Prinz J (2012) NIST/SEMATECH e-Handbook of Statistical Methods. (National Institute of Standards and Technology, Gaithersburg, MD). https://doi.org/10.18434/M32189
- [19] Stevens SS (1946) On the Scales of Measurement. Science 103(2684):677-680. http://www.jstor.org/stable/1671815
- [20] Turan MS, Barker E, Kelsey J, McKay KA, Baish ML, Boyle M (2018) Recommendation for the Entropy Sources Used for Random Bit Generation. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-90B. https://doi.org/10.6028/NIST.SP.800-90B
- [21] Stolfo S, Bellovin S, Evans D (2011) Measuring Security. IEEE Security & Privacy 9(3):6065. https://doi.org/10.1109/MSP.2011.56
- [22] Ross R, Pillitteri V, Graubart R, Bodeau D, McQuaid R (2021) Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-160v2r1. https://doi.org/10.6028/NIST.SP.800-160v2r1
- [23] Schroeder K, Trinh H, Pillitteri VY (2024) Measurement Guide for Information Security: Volume 2 - Developing an Information Security Measurement Program. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-55v2. https://doi.org/10.6028/NIST.SP.800-55v2

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

t a central point ensures all VOIP traffic emanating from the enterprise network has been encrypted. Newer IP phones are able to provide Advanced Encryption System (AES) encryption at reasonable cost.
Note that Federal Information Processing Standard (FIPS) 140-2, Security Requirements for Cryptographic Modules, is applicable to all Federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems (including voice systems) as defined in Section 5131 of the Information Technology Management Reform Act of 1996, Public Law 104-106. 2. Ensure that the organization has examined and can acceptably manage and mitigate the risks to their information, system operations, and continuity of essential operations when deploying VOIP systems.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MA.L2-3.7.1 (NIST 3.7.1)?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

3.7.1. 3.7.1. 3.7.1.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Best Practices for Privileged User PIV Authentication:

For many years, most organizations, including federal agencies, have relied heavily on password-based single-factor user authentication. There are many types of threats against this form of authentication, including the following:

All of these threats can be exploited by an attacker obtaining the identity credential (the singlefactor password) of a legitimate user to gain unauthorized access to an agency's systems and/or networks with that user's privileges. If a password is used across multiple systems, the compromise of this password enables unauthorized access to all the other systems. There are some controls available to counter these threats, but they have limited effectiveness, so the threats as a whole against password-based single-factor user authentication can only be slightly mitigated. Many attackers leverage the impersonation of a regular user into greater access to an agency's systems and networks by issuing subsequent attacks to escalate privileges and gain administrative-level access. This, in turn, can be used to move from system to system, surreptitiously traveling through the enterprise to eventually reach a High Value Asset. 3 Administrative-level access can also be used to tamper with system integrity by establishing backdoors into the system, such as creating additional privileged accounts or altering a service to permit unauthorized access to the system. An attacker can use these backdoors to gain persistent access to the system.

For more information on general threat models and mitigations for the identity management lifecycle, including identity proofing, registration, issuance, and revocation, see the latest revision of NIST SP 800-63 [2] .

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guidelines on Active Content and Mobile Code:

Besides  spyware,  Web  site  developers  have  a  myriad  of  tools  at  their  disposal  to  collect personal information.  They include tracking site use by storing persistent information known as cookies via a user's browser; embedding invisible single-pixel images within HTML called Web bugs that serve as a signal of page access; and invoking the communication capabilities of downloaded scripts and program components.

Guidelines on Active Content and Mobile Code


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automation Support for Security Control Assessments_ Software Vulnerability Management provide? (Part 5)

[Assistant]
this document. ## Document Conventions

The terms 'shall' and 'shall not' indicate requirements to be followed strictly in order to conform to the publication and from which no deviation is permitted.
The terms 'should' and 'should not' indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others, or that a certain course of action is preferred but not necessarily required, or that (in the negative form) a certain possibility or course of action is discouraged but not prohibited. The terms 'may' and 'need not' indicate a course of action permissible within the limits of the publication. The terms 'can' and 'cannot' indicate a possibility and capability, whether material, physical or causal. The security capability designation 'VULN' was utilized in previous volumes of NISTIR 8011 in reference to the Software Vulnerability Management security capability. For greater consistency with industry, academia, and other federal agencies, the more widely used designation for the Software Vulnerability Management security capability, 'VUL,' replaces VULN herein and in future NISTIR 8011 volumes when referring to the Software Vulnerability Management security capability. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Technical Guide to Information Security Testing and Assessment:

For internal security testing, assessors work from the internal network and assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses. This kind of testing can reveal vulnerabilities that could be exploited, and demonstrates the potential damage this type of attacker could cause. Internal security testing also focuses on system-level security and configuration-including application and service configuration, authentication, access control, and system hardening. Log review determines if security controls are logging the proper information, and if the organization is adhering to its log management policies. 7 As a source of historical information, audit logs can be used to help validate that the system is operating in accordance with established policies. For example, if the logging policy states that all authentication attempts to critical servers must be logged, the log review will determine if this information is being collected and shows the appropriate level of detail. Log review may also reveal problems such as misconfigured services and security controls, unauthorized accesses, and attempted intrusions. For example, if an intrusion detection system (IDS) sensor is placed behind a firewall, its logs can be used to examine communications that the firewall allows into the network. If the sensor registers activities that should be blocked, it indicates that the firewall is not configured securely. - GLYPH<c=31,font=/DGCOEC+Webdings> Authentication server or system logs may include successful and failed authentication attempts. - GLYPH<c=31,font=/DGCOEC+Webdings> System logs may include system and service startup and shutdown information, installation of unauthorized software, file accesses, security policy changes, account changes (e.g., account creation and deletion, account privilege assignment), and privilege use.

Technical Guide to Information Security Testing and Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to A Security Perspective on the Web3 Paradigm:

Between the late 1980s and early 2000s, the internet hosted very basic websites that were mostly comprised of text (often just plain text but sometimes with simple formatting), images, and hyperlinks to other webpages. As a result, this era has since been dubbed the 'static' or 'read-only' web. Most websites were hosted by large organizations, government agencies, internet service providers, or tech-savvy users who were allotted a small portion of web storage from their internet service provider or other web-hosting provider to develop their own 'home page.' Websites eventually began to create more designs and styles via Hypertext Markup Language (HTML) tables, which allowed developers to change the format of their page. During this period, there were also some 'dynamic' pages on the web that used the Common Gateway Interface (CGI) to execute code on the server and generate a static webpage to be delivered to the end user. There were little to no client-side manipulatable websites. Online communications were done through email, bulletin boards, and forums, and there was almost no online shopping. Since there was not a lot of user interaction, organizations did not host massive amounts of user data. Web3 utilizes existing internet technologies that make up much of the current web architecture, such as Transmission Control Protocol/Internet Protocol (TCP/IP), remote procedure call (RPC), and Transport Layer Security (TLS). It can also use existing web services, servers, databases, and webpages to act as an interface. Web3 applications can be designed to interact with (as both input to and utilize output from) existing systems. Like blockchain systems and cryptocurrency systems, Web3 leverages well-known technologies, such as publickey cryptography, digital signatures, and cryptographic hashing algorithms. - [20] Department of Financial Protection & Innovation (2023) Crypto Scam Tracker.

A Security Perspective on the Web3 Paradigm


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Glossary of Computer Security Terminology provide? (Part 3)

[Assistant]
sitiue to aborted connections, and do not detect the disconnect and reset for the next user. Continued aborts are considered [improper], and may result in a warning or revocation of access privileges.
(BBD)   |
|--------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| acceptable level of risk | A judicious and carefully considered assessment by the appropriate designated approving authority (DAA) that an automatic data processing (ADP) activity or network meets the minimum requirements of applicable security directives. The assessment should take into account the value of ADP assets; threats and vulnerabilities; countermeasures and their efficacy in compensating for vulnerabilities; and operational requirements. (OPNAVINST 5239.1 A)            |
| acceptance               | Indicates a facility or system generally meets technical and performance standards but may have minor exceptions which do not keep the facility from meeting operational and security requirements, (APR 700-10)                                                                                |
| acceptance inspection    | The final inspection to determine if a facility or system meets the specified technical and performance standards. It is held immediately after facility and software testing and is the basis for commissioning or accepting the information system.

Glossary of Computer Security Terminology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice MP.L2-3.8.1 (NIST 3.8.1)?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

3.8.1, 3.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Cell Phone Forensic Tools_ an Overview and Analysis Update:

The acquisition process begins by successfully logging into the PhoneBase2 application via either Admin or an assigned username, creating a case (e.g., File -> New) and adding a unique record to a database provided with the PhoneBase2 software, as illustrated below in Figure 34 and Figure 35.

Cell Phone Forensic Tools_ an Overview and Analysis Update


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

| TRUSTED PATH/CHANNELS (FTP)...........................................................................................
| B22                                                                                |
| B.10.1                                                                                | FTP_ITC.1-CSPP Inter-TSF trusted channel                                                                                | ................................................................ B22                |
| C. APPENDIX C: TOE ASSURANCE REQUIREMENT DETAILS...........................................C1                                      | C. APPENDIX C: TOE ASSURANCE REQUIREMENT DETAILS...........................................C1                                                                                |                                                                                |
| C.1                                                                                | CONFIGURATION MANAGEMENT (ACM)................................................................................. | C1                                                                                |
| C.1.1                                                                                | ACM_CAP.3 Authorization controls...................................................................................

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to User's Guide to Telework and Bring Your Own Device (BYOD) Security:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

User's Guide to Telework and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Forensics Web Services (FWS) provide? (Part 5)

[Assistant]
|
|      | 2.3                                                                                | Static vs.
Dynamic Composition .................................................................................3                  |
|      | 2.4                                                                                | Hierarchical vs, Conversational Composition……………………………………………4                                                                      |
|      | 2.5                                                                                | Composition Standards and Languages.....................................................................4                          |
|      | 2.6                                                                                | Web ServicesExample…………………………………………………………………….5                                                                                |
| 3. | WEBSERVICEATTACKS………………………………………………………………………..6                                                                                | WEBSERVICEATTACKS………………………………………………………………………..6                                                                                |
| 4. | CHALLENGES IN FORENSICS OF WEB SERVICES………………………………………...8                                                                         | CHALLENGES IN FORENSICS OF WEB SERVICES………………………………………...8                                                                         |
| 5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

Balancing exposure to cybersecurity risks throughout the supply chain with the costs and benefits of implementing C-SCRM practices and controls should be a key component of the acquirer's overall approach to C-SCRM. Enterprises should be aware that implementing C-SCRM practices and controls necessitates additional financial and human resources. Requiring a greater level of testing, documentation, or security features from suppliers, developers, system integrators, external system service providers, and other ICT/OT-related service providers may increase the price of a product or service, which may result in increased cost to the acquirer. This is especially true for those products and services developed for general-purpose applications and not tailored to the specific enterprise security or C-SCRM requirements. When deciding whether to require and implement C-SCRM practices and controls, acquirers should consider both the costs of implementing these controls and the risks of not implementing them.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

3.3.2 Building Blocks for CI/CD Pipelines                                                      | ... 3.3.2 Building Blocks for CI/CD Pipelines

The primary software for defining CI/CD pipeline resources, building the pipelines, and executing those pipelines is the CI/CD pipeline software.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.6 (NIST 3.3.6)?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

3.3.6                                                                                | Storage Network (Tap Into, Alter to Gain Access)... 3.3.6 Storage Network (Tap Into, Alter to Gain Access)

When storage clients consume data from the storage systems, the data is transferred through a variety of storage network components (i.

Security Guidelines for Storage Infrastructure